Craigslist password protected email danger – How to avoid the malware

I received an email that appeared to be a response to a craigslist posting I made. The email said to open the Word document with the supplied password for the contact information. As soon as I saw that I pictured the goofy robot with it’s arms flailing saying “Danger Will Robinson. DANGER, DANGER”, or the weird fish guy saying “It’s a trap!!”. Here is how to identify these traps.

There were a number of obvious clues that this was not a legitimate email.

Why would anyone put their contact information in a password protected document?

The wording of the email was not that of a native English speaker.

The body of the email was not text, it was an image. This helps the email evade anti malware tools that protect your email.

If a document is encrypted virus scanners cannot determine that it carries malware because they cannot read the contents until it is decrypted.

NEVER enter a password given for a password protected MS Office document or PDF file unless you are absolutely sure of the identity of the sender.

In order to infect a user, the following has to happen:

The receiver needs to try to open the attached .doc file with Microsoft word

The receiver needs to enter the correct password

Macros must be enabled in Word.

I don’t use Word on my Windows 10 laptop, I use Libre Office. Even so, I would be leery of opening the document. I switched to a Ubuntu (linux) machine and opened it there. A message pops up telling you to enable macros to view the document.